Low
CVE-2026-48011
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-48010
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Medium
CVE-2026-48009
Shopware: Admin Account Takeover via User Recovery Hash Exposure
Medium
CVE-2026-48008
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Medium
CVE-2026-50183
WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
Medium
CVE-2026-50182
WWBN AVideo: Unauthenticated Reflected XSS via $_GET['search'] in AVideo YouTubeAPI Gallery Pagination
High
CVE-2026-49279
WWBN AVideo: Stored XSS via autoEvalCodeOnHTML Bypass in MessageSQLite WebSocket Handler (CVE-2026-43874 Bypass)
High
CVE-2026-47696
WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
Medium
CVE-2026-47694
WWBN AVideo: Stored XSS via unescaped Gallery category description
Critical
CVE-2026-50076
Apache Fory Java SDK Has Deserialization of Untrusted Data in the Java replace-resolve path
Medium
CVE-2026-47676
Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths
Medium
CVE-2026-47674
Hono: IP Restriction bypasses static deny rules for non-canonical IPv6
Medium
CVE-2026-47675
Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie injection
Medium
CVE-2026-47673
Hono: JWT middleware accepts any Authorization scheme, not only Bearer
Medium
CVE-2026-47672
epa4all-client: Unauthenticated REST API for Patient Record Writes
High
CVE-2026-34077
React Router vulnerable to Denial of Service via reflected user input in single-fetch
Medium
CVE-2026-47707
Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification
Medium
CVE-2026-47706
Strawberry GraphQL has a Circular Fragment Reference DOS
Low
CVE-2026-45739
Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs
High
CVE-2026-45337
Better Auth: Device authorization approve and deny accept any authenticated session while the user code is pending
High
CVE-2026-44496
Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection
High
CVE-2026-44488
Allocation of Resources Without Limits or Throttling in Axios
High
CVE-2026-44487
Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.